Quand l'utiliser : Someone sent you a cool-looking skill link. Before clone, you want to know if it's safe.
Déroulement
-
Point at the target repo URL
Use repo-forensics. Scan https://github.com/<author>/<skill> with the skill_threats, secrets, dataflow, and lifecycle scanners. Report findings.✓ Copié
→ Per-scanner report with severity flags
-
Read correlated findings
Any correlations across scanners — e.g. a secret-leak path plus a lifecycle hook?✓ Copié
→ Correlation summary
Résultat : A go / no-go decision grounded in scanner output, not vibes.
Pièges
- Trusting a green scan as full proof of safety — Scanners are strong floor, not a ceiling — still read SKILL.md
Quand l'utiliser : Before adding a new MCP server to an agent with real permissions.
Déroulement
-
Run MCP-focused scanners
Scan this MCP server repo with mcp_security, skill_threats, integrity, and dast.✓ Copié
→ Findings focused on tool descriptions and install scripts
-
Check git history for identity spoofing
Run git_forensics on the same repo — any spoofed commits?✓ Copié
→ Author / signing analysis
Résultat : An MCP security dossier before you wire it into your agent.
Quand l'utiliser : Install finished with unexpected behavior; you want to know if something landed.
Déroulement
-
Run post_incident + entropy scans
Run post_incident scanner on ~/.npm and the current project. Also entropy scan the installed packages.✓ Copié
→ Flags for suspicious cached artifacts or encoded payloads
Résultat : Evidence of whether to rotate secrets and rebuild.
Pièges
- Running scans from the potentially-compromised shell — Run from a fresh shell or another machine when in doubt